How to Shut Down Elasticsearch in Terminal

How to Shut Down Elasticsearch in Terminal


An Elasticsearch node can run indefinitely, but you’ll eventually need to shut it down for maintenance or some other reason. A graceful shut down of Elasticsearch releases system resources, making them available for other programs. For example, an Elasticsearch node that’s shut down gracefully will remove itself from its cluster, synchronize translogs to disk and perform other related cleanup activities. These activities include the deletion of temporary files, which free up space on your hard drive. Another useful feature for optimizing Elasticsearch is the Curator tool, although that’s beyond the scope of this article.

This tutorial shows how to shut down Elasticsearch in Terminal. It provides three distinct methods, including shutting the node down, stopping the Elasticsearch service and using the Unix grep command. The _shutdown API is no longer an option for shutting Elasticsearch down because it was removed in Elasticsearch version 2.x.

  • The grep command won’t always list an active session of Elastic service, depending on the version of Unix you’re using. The most reliable way to determine if Elastic is running is to navigate to the port that’s running Elasticsearch in your browser. The following command shows how to navigate to port 9200, which is Elastic’s default port:

Shut Down the Node

  • If your node is running attached in your terminal, you can stop the service by pressing CTRL + C.

  • You can also decommission a node by “excluding” it from allocation and shutting it down with a cURL request.

  • The following command excludes a node from allocation:

curl -XPUT localhost:9200/_cluster/settings -d '{
"transient" :{
"cluster.routing.allocation.exclude._ip" : ""
  • This command shuts down Elasticsearch with a cURL request:
curl -XPOST 'http://localhost:9200/_shutdown'
  • The above procedure allocates the shards on the Elasticsearch to the other nodes on that cluster. Once the shards have been re-allocated, you can then shut down the node. The cURL request prevents the system from making replicas of the node.

Stop the Elasticsearch Service

  • If you’re running Elasticsearch as a service, you can stop it via the service management functionality included in the Elasticsearch installation. This is the simplest method for shutting down Elasticsearch on both Linux and macOS machines, since it uses a single built-in command as follows: `bash service elasticsearch stop `

  • Restart the Elasticsearch service with the following command:

service elasticsearch restart

Kill the Elasticsearch Service

  • Killing the Elasticsearch service with the Unix kill command requires you to know Elasticsearch’s process identifier (PID). You can get this information by using the following grep command on your terminal to list all of the Java processes currently running on your machine or server:
ps aux | grep java
  • The above command will return the PID and service name of any Java services that are currently running as follows:
12345 Jps
  • The grep command won’t return anything if no Java services are running.

  • You can make your search for Elasticsearch’s more precise by using the jps tool to find any instances of JVM that are associated with Elasticsearch as follows:

jps | grep Elasticsearch

If any such instances of JVM are running, the grep command should output the PID along with the service name to your terminal as follows:

12345 Jps
  • Combining the commands (jps and grep) allows you to specify a search for the Elasticsearch processes as follows:
$ jps | grep Elasticsearch
  • The output of the above command should be the PID and process name as follows, just as it was with the Java example:
12345 Elasticsearch
  • Once you have the PID number for Elasticsearch, you can use the kill command to end the process as follows:
$ kill 14542
  • If the Elasticsearch service is running as a background daemon, you can also kill it with SIGTERM’s kill command and the -15 option followed by the PID number. The following command shows how to do this:
$ kill -15 {PID}
  • Another option is to use the taskkill.exe command as follows:
taskkill /pid {PID}


There are multiple ways of performing a clean shutdown of Elasticsearch to ensure it releases any resources that it’s using. These step-by-step instructions explained three general methods of accomplishing this task, including shutting the Elasticsearch node down, stopping the service and killing the Elasticsearch process. They also demonstrated multiple variations of these approaches.

Keep in the know!

Subscribe to our emails and we’ll let you know what’s going on at ObjectRocket. We hate spam and make it easy to unsubscribe.